Linux kernel (drivers/infiniband/hw/irdma): The pseudo memory regions that back a QP/CQ/SRQ have no real hardware key

Impact

The pseudo memory regions that back a QP/CQ/SRQ have no real hardware key, but the core still exposes them as normal MRs. A tenant that calls re-register on one drives a control-plane command against key 0 - an unvalidated operation on adapter-global state that other tenants on the same NIC depend on.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node calls ibv_rereg_mr on the MR it registered for its own QP/CQ/SRQ buffers. Purely local to the tenant; no fabric peer or host root.

What to do

Update to 6.6.148 or later, or a stable kernel carrying fb46d134e1b8 / b5029e91c634, and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References

Related entries

• Linux kernel (drivers/infiniband/hw/irdma): The page-address copy loop only honoured its bound when the bound wasCVE-2026-74390 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): A permanent kernel hang once any queue-pair goes to error.CVE-2022-48694 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): Queue-depth arithmetic was done in 32 bits, so a tenant passing a hugeCVE-2026-31491 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): A stale flag caused the CQ memory-registration path to read one elementCVE-2026-74346 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma'sCVE-2026-31492 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queueCVE-2026-68418 · Linux kernel (drivers/infiniband/hw/irdma)Medium